feat(results): expose Tekton Results Watcher config via TektonConfig

config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml

@@ -531,6 +531,8 @@ spec:
                           type: string
                       type: object
                     type: array
+                required:
+                - options
                 type: object
               multiclusterProxyAAE:
                 description: MulticlusterProxyAAE holds the customizable options for
@@ -1202,6 +1204,74 @@ spec:
                     type: string
                   tls_hostname_override:
                     type: string
+                  watcher:
+                    description: Watcher holds configuration for the Tekton Results
+                      Watcher controller.
+                    properties:
+                      check_owner:
+                        description: |-
+                          When true, resources with owner references are not deleted after the grace
+                          period. When false, owner references are ignored for deletion.
+                        type: boolean
+                      completed_run_grace_period:
+                        description: |-
+                          Grace period before completed TaskRuns/PipelineRuns are deleted from the
+                          cluster after being stored in Results. 0 disables deletion. Negative
+                          values delete immediately after completion.
+                        type: string
+                      disable_crd_update:
+                        description: Disable updating Tekton CRD annotations during
+                          reconcile.
+                        type: boolean
+                      disable_storing_incomplete_runs:
+                        description: |-
+                          When true, only store Runs after they complete. When false, store Runs on
+                          every update throughout their lifecycle.
+                        type: boolean
+                      dynamic_reconcile_timeout:
+                        description: Timeout for the dynamic reconciler to process
+                          an event.
+                        type: string
+                      forward_buffer:
+                        description: Duration to wait for log forwarder to finish
+                          after TaskRun completion.
+                        type: string
+                      label_selector:
+                        description: Label selector for Runs eligible for deletion
+                          after the grace period.
+                        type: string
+                      logs_api:
+                        description: Enable sending TaskRun/PipelineRun logs to the
+                          Results API.
+                        type: boolean
+                      logs_timestamps:
+                        description: Collect logs with timestamps.
+                        type: boolean
+                      requeue_interval:
+                        description: How long the Watcher waits before reprocessing
+                          keys on certain events.
+                        type: string
+                      store_deadline:
+                        description: |-
+                          Maximum time to wait for a Run to be stored before clearing the finalizer
+                          during deletion.
+                        type: string
+                      store_event:
+                        description: Store Kubernetes events related to TaskRuns and
+                          PipelineRuns.
+                        type: boolean
+                      summary_annotations:
+                        description: Comma-separated annotation keys copied into the
+                          Result summary.
+                        type: string
+                      summary_labels:
+                        description: Comma-separated label keys copied into the Result
+                          summary.
+                        type: string
+                      update_log_timeout:
+                        description: Timeout for storing logs before aborting.
+                        type: string
+                    type: object
                 required:
                 - disabled
                 - is_external_db

config/base/generated-crds/operator.tekton.dev_tektonresults.yaml

@@ -268,6 +268,72 @@ spec:
                 type: string
               tls_hostname_override:
                 type: string
+              watcher:
+                description: Watcher holds configuration for the Tekton Results Watcher
+                  controller.
+                properties:
+                  check_owner:
+                    description: |-
+                      When true, resources with owner references are not deleted after the grace
+                      period. When false, owner references are ignored for deletion.
+                    type: boolean
+                  completed_run_grace_period:
+                    description: |-
+                      Grace period before completed TaskRuns/PipelineRuns are deleted from the
+                      cluster after being stored in Results. 0 disables deletion. Negative
+                      values delete immediately after completion.
+                    type: string
+                  disable_crd_update:
+                    description: Disable updating Tekton CRD annotations during reconcile.
+                    type: boolean
+                  disable_storing_incomplete_runs:
+                    description: |-
+                      When true, only store Runs after they complete. When false, store Runs on
+                      every update throughout their lifecycle.
+                    type: boolean
+                  dynamic_reconcile_timeout:
+                    description: Timeout for the dynamic reconciler to process an
+                      event.
+                    type: string
+                  forward_buffer:
+                    description: Duration to wait for log forwarder to finish after
+                      TaskRun completion.
+                    type: string
+                  label_selector:
+                    description: Label selector for Runs eligible for deletion after
+                      the grace period.
+                    type: string
+                  logs_api:
+                    description: Enable sending TaskRun/PipelineRun logs to the Results
+                      API.
+                    type: boolean
+                  logs_timestamps:
+                    description: Collect logs with timestamps.
+                    type: boolean
+                  requeue_interval:
+                    description: How long the Watcher waits before reprocessing keys
+                      on certain events.
+                    type: string
+                  store_deadline:
+                    description: |-
+                      Maximum time to wait for a Run to be stored before clearing the finalizer
+                      during deletion.
+                    type: string
+                  store_event:
+                    description: Store Kubernetes events related to TaskRuns and PipelineRuns.
+                    type: boolean
+                  summary_annotations:
+                    description: Comma-separated annotation keys copied into the Result
+                      summary.
+                    type: string
+                  summary_labels:
+                    description: Comma-separated label keys copied into the Result
+                      summary.
+                    type: string
+                  update_log_timeout:
+                    description: Timeout for storing logs before aborting.
+                    type: string
+                type: object
             required:
             - disabled
             - is_external_db

docs/TektonConfig.md

@@ -349,8 +349,62 @@ result:
   loki_stack_namespace: #optional
   prometheus_port: 9090
   prometheus_histogram: false
+  watcher:
+    completed_run_grace_period: 24h
+    check_owner: true
+    store_deadline: 10m
+    disable_storing_incomplete_runs: true
 ```
 
+#### Tekton Results Watcher configuration
+
+Watcher-specific settings are configured under `result.watcher`. These map to command-line flags on the `tekton-results-watcher` deployment. See [Results Watcher documentation](https://tekton.dev/docs/results/watcher/) for behavior details.
+
+Not every watcher flag is exposed under `result.watcher`:
+- Performance flags (`threadiness`, `qps`, `burst`, `disable-ha`) are configured under `result.performance`.
+- Operator-managed flags (`api_addr`, `auth_mode`, `namespace`) are set by the operator and must not be overridden.
+- Secrets (`token`) must not be stored in the CR; use Secrets / `auth_mode` instead.
+
+For optional string fields (`summary_labels`, `summary_annotations`, `label_selector`):
+- omit the field to keep the watcher binary default
+- set a non-empty value to override
+- set `""` to clear the default (operator passes an empty flag value)
+
+Example:
+
+```yaml
+result:
+  disabled: false
+  watcher:
+    completed_run_grace_period: 24h
+    check_owner: true
+    store_deadline: 10m
+    disable_storing_incomplete_runs: true
+    logs_api: true
+    logs_timestamps: false
+    store_event: false
+    summary_labels: tekton.dev/pipeline
+    label_selector: ""
+```
+
+| Field | Watcher flag | Default | Description |
+|---|---|---|---|
+| `completed_run_grace_period` | `-completed_run_grace_period` | `0` | Time after completion before deleting Runs from the cluster. `0` disables deletion. |
+| `check_owner` | `-check_owner` | `true` | Skip deletion when the Run has owner references. |
+| `store_deadline` | `-store_deadline` | `10m` | Max wait to store a Run before clearing its finalizer on delete. |
+| `disable_storing_incomplete_runs` | `-disable_storing_incomplete_runs` | `false` | Only store Runs after they complete. |
+| `logs_api` | `-logs_api` | `false` | Send logs to the Results API (separate from API server `logs_api`). |
+| `logs_timestamps` | `-logs_timestamps` | `false` | Include timestamps in stored logs. |
+| `store_event` | `-store_event` | `false` | Store Kubernetes events related to Runs. |
+| `summary_labels` | `-summary_labels` | `tekton.dev/pipeline` | Comma-separated labels copied into Result summary. Omit to keep default; `""` clears it. |
+| `summary_annotations` | `-summary_annotations` | `""` | Comma-separated annotations copied into Result summary. Omit to keep default; `""` clears it. |
+| `label_selector` | `-label_selector` | `""` | Label selector for Runs eligible for post-grace deletion. Omit to keep default; `""` clears it. |
+| `requeue_interval` | `-requeue_interval` | `10m` | Requeue delay for certain watcher events. |
+| `forward_buffer` | `-forward_buffer` | `150s` | Wait time for log forwarder after TaskRun completion. |
+| `update_log_timeout` | `-update_log_timeout` | `300s` | Timeout for log storage operations. |
+| `dynamic_reconcile_timeout` | `-dynamic_reconcile_timeout` | `30s` | Timeout for dynamic reconciler processing. |
+| `disable_crd_update` | `-disable_crd_update` | `false` | Disable Tekton CRD annotation updates during reconcile. |
+
 User can configure custom database secret name for internal/external database via Tekton Config CR.
 
 Example:

docs/TektonResult.md

@@ -310,6 +310,27 @@ These fields are optional and there is no default values. If user passes them, o
 > #### Note:
 > * if you modify or remove any of the performance properties, `tekton-results-watcher` deployment and `tekton-results-config-leader-election` config-map (if `buckets` changed) will be updated, and `tekton-results-watcher` pods will be recreated
 
+### Tekton Result Watcher Configuration
+
+Watcher behavior is configured under `spec.result.watcher` on TektonConfig, or `spec.watcher` on TektonResult. These settings are passed as command-line flags to the `tekton-results-watcher` deployment. Updating these fields reconciles the watcher Deployment and recreates pods so the new configuration takes effect.
+
+Performance-related flags remain under `spec.result.performance` (TektonConfig) / `spec.performance` (TektonResult). Operator-managed flags (`api_addr`, `auth_mode`, `namespace`) and secrets (`token`) are not exposed here.
+
+For `summary_labels`, `summary_annotations`, and `label_selector`: omit the field to keep the watcher default, set a value to override, or set `""` to clear the default.
+
+```yaml
+spec:
+  # omitted other fields ...
+  watcher:
+    completed_run_grace_period: 24h
+    check_owner: true
+    store_deadline: 10m
+    disable_storing_incomplete_runs: true
+    logs_api: true
+```
+
+See [TektonConfig Result Watcher section](./TektonConfig.md#tekton-results-watcher-configuration) for the full list of supported fields.
+
 ### Debugging
 
 #### Debugging gRPC

pkg/apis/operator/v1alpha1/tektonconfig_validation.go

@@ -141,6 +141,7 @@ func (tc *TektonConfig) Validate(ctx context.Context) (errs *apis.FieldError) {
 	errs = errs.Also(tc.Spec.Chain.Options.validate("spec.chain.options"))
 	errs = errs.Also(tc.Spec.Trigger.Options.validate("spec.trigger.options"))
 	errs = errs.Also(tc.Spec.Result.Options.validate("spec.result.options"))
+	errs = errs.Also(tc.Spec.Result.Watcher.Validate("spec.result.watcher"))
 	errs = errs.Also(tc.Spec.MulticlusterProxyAAE.Options.validate("spec.multiclusterProxyAAE.options"))
 
 	return errs.Also(tc.Spec.Trigger.TriggersProperties.validate("spec.trigger"))

pkg/apis/operator/v1alpha1/tektonconfig_validation_test.go

@@ -413,3 +413,28 @@ func Test_ValidateTektonConfig_PrunerConfig_Invalid(t *testing.T) {
 	err := tc.Validate(context.TODO())
 	assert.ErrorContains(t, err, "pruner config validation failed")
 }
+
+func Test_ValidateTektonConfig_ResultWatcher(t *testing.T) {
+	tc := &TektonConfig{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "config",
+			Namespace: "namespace",
+		},
+		Spec: TektonConfigSpec{
+			CommonSpec: CommonSpec{
+				TargetNamespace: "namespace",
+			},
+			Profile: "all",
+			Pruner:  Prune{Disabled: true},
+			Result: Result{
+				Watcher: ResultsWatcherProperties{
+					LabelSelector: ptr.String("not a valid selector=="),
+				},
+			},
+		},
+	}
+
+	err := tc.Validate(context.TODO())
+	assert.Assert(t, err != nil)
+	assert.ErrorContains(t, err, "spec.result.watcher.label_selector")
+}

pkg/apis/operator/v1alpha1/tektonresult_types.go

@@ -82,6 +82,9 @@ type Result struct {
 	Options AdditionalOptions `json:"options"`
 	// +optional
 	Performance PerformanceProperties `json:"performance,omitempty"`
+	// Watcher holds configuration for the Tekton Results Watcher controller.
+	// +optional
+	Watcher ResultsWatcherProperties `json:"watcher,omitempty"`
 }
 
 // ResultsAPIProperties defines the fields which are configurable for

pkg/apis/operator/v1alpha1/tektonresult_validation.go

@@ -57,5 +57,8 @@ func (trs *TektonResultSpec) validate(path string) (errs *apis.FieldError) {
 	// validate performance properties
 	errs = errs.Also(trs.Performance.Validate(fmt.Sprintf("%s.performance", path)))
 
+	// validate watcher properties
+	errs = errs.Also(trs.Watcher.Validate(fmt.Sprintf("%s.watcher", path)))
+
 	return errs
 }